This is EAP245v3 hardware:
So I was able to get OpenWRT kernel booting. I still have a long way to go, but it's a start.
The TP-Link bootloader requires all images to be signed using their key, so I couldn't use the tftp recovery method
On the underside of the board, there's a unpopulated R225 resistor that was able to connect to to get 115200 baud 8n1 UART output. I need to bridge solder it, but it at least works by holding a jumper wire against it.
I then created a custom U-Boot image with j-d-r's https://github.com/j-d-r/u-boot-QCA956x. Network doesn't seem to work, so I wasn't able to get a web recovery console, even though it was listening on 192.168.1.1. It detects when a cable is plugged in, but it won't bring up a network stack. It's something else for me to look at as well.
I switched the BOOTCOMMAND to "bootm 0x9f0c0000". It was set to "bootelf" before, which works with the existing TP-Link image (it's an ELF image). Because I'm booting an OpenWRT initramfs, I needed to change to "bootm 0x9f0c0000".
Then I overwrote the original image that I dumped from SPI (using dd) with the u-boot image I crafted and the Archer c7 v5 OpenWRT initramfs kernel image I compiled. Then I took this crafted image and flashed it onto my EAP245v3 with my SPI programmer.
Here's output from my UART console (ignore the versioning, I didn't get around to changing it):
***************************************
* U-Boot 1.1.4-90b788c2-dirty *
* Build: 2020-05-28 *
***************************************
** Warning: bad env CRC, using default,
use 'saveenv' to save it in FLASH
BOARD: TP-Link EAP245 v1
SOC: QCA956x rev. 0
CPU: MIPS 74Kc
RAM: 128 MB DDR2 16-bit CL6-5-5-13
FLASH: 16 MB Winbond W25Q128
PCIe: QCA99X0
MAC: 00:DE:AD:BE:EF:00
UART: 111607 bps
CLOCKS: CPU/RAM/AHB/SPI/REF
775/650/258/ 18/ 25 MHz
Hit any key to stop booting: 0
Booting image from 0x9F0C0000...
Image name: MIPS OpenWrt Linux-4.14.171
Build date: 2020-02-27 21:05:12 UTC
Architecture: MIPS
OS/image type: Linux Kernel
Compression: LZMA
Data size: 3.5 MB (3659176 bytes)
Load address: 0x80060000
Entry point: 0x80060000
Header CRC... OK!
Data CRC... skipped
Stopping network... OK!
Uncompressing Kernel... OK!
Starting kernel...
[ 0.000000] Linux version 4.14.171 (root@edca4f546068) (gcc version 7.5.0 (OpenWrt GCC 7.5.0 r10947-65030d81f3)) #0 Thu Feb 27 21:05:12 2020
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[ 0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 08000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff]
...............
I do get some errors about network devices not being initialized, but I'll work on that.
So yeah.. progress